php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #46911 Command like stream_filter_prepend(STDOUT, "strtoupper") crashes PHP
Submitted: 2008-12-19 22:51 UTC Modified: 2014-04-03 12:13 UTC
Votes:8
Avg. Score:4.5 ± 0.9
Reproduced:4 of 4 (100.0%)
Same Version:3 (75.0%)
Same OS:2 (50.0%)
From: dmitry dot koterov at gmail dot com Assigned: mike (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.*, 6CVS (2009-04-30) OS: *
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: dmitry dot koterov at gmail dot com
New email:
PHP Version: OS:

 

 [2008-12-19 22:51 UTC] dmitry dot koterov at gmail dot com
Description:
------------
I am trying to redirect default STDOUT to some other place (e.g. to a stream socket or just handle it via stream filter).

And I reproduce the PHP crash.

P.S.
Is it possibly at all to redirect STDOUT to some other place (e.g. socket)? It is needed for me to create socket-listening daemon. Usual "echo" commands should be redirected to socket. Ob_start() is not enough for me, because somewhere in server code OB level nesting may be accidentally broken, so I am looking for PHP's equivalent to Perl's "open(STDOUT, '>&SOCK')".

Reproduce code:
---------------
<?php
class strtoupper_filter extends php_user_filter {
    function filter($in, $out, &$consumed, $closing)
    {
        while ($bucket = stream_bucket_make_writeable($in)) {
            $bucket->data = strtoupper($bucket->data);
            $consumed += $bucket->datalen;
            stream_bucket_append($out, $bucket);
        }
        return PSFS_PASS_ON;
    }
}

stream_filter_register("strtoupper", "strtoupper_filter")
    or die("Failed to register filter");

stream_filter_prepend(STDOUT, "strtoupper");
echo "abcd\n";


Expected result:
----------------
ABCD

or at least

abcd

Actual result:
--------------
abcd
Segmentation fault

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-12-19 23:56 UTC] crrodriguez at opensuse dot org
VERIFIED in 5.3

(gdb) bt
#0  0x00000000007f256b in _zend_is_inconsistent (ht=0x5a5a5a5a5a5a5a5a, file=0xaf98d8 "/home/cristian/php5/Zend/zend_hash.c", line=875)
    at /home/cristian/php5/Zend/zend_hash.c:53
#1  0x00000000007f51ed in zend_hash_find (ht=0x5a5a5a5a5a5a5a5a, arKey=0xadf040 "stream", nKeyLength=7, pData=0x7fffffffd408)
    at /home/cristian/php5/Zend/zend_hash.c:875
#2  0x0000000000742b0e in userfilter_filter (stream=0xfd3550, thisfilter=0xfd8220, buckets_in=0x7fffffffd4b0, buckets_out=0x7fffffffd4a0,
    bytes_consumed=0x7fffffffd4f0, flags=2) at /home/cristian/php5/ext/standard/user_filters.c:183
#3  0x00000000007833c6 in _php_stream_write_filtered (stream=0xfd3550, buf=0x0, count=0, flags=2)
    at /home/cristian/php5/main/streams/streams.c:986
#4  0x00000000007834b2 in _php_stream_flush (stream=0xfd3550, closing=1) at /home/cristian/php5/main/streams/streams.c:1035
#5  0x000000000078196f in _php_stream_free (stream=0xfd3550, close_options=11) at /home/cristian/php5/main/streams/streams.c:331
#6  0x00000000007845c3 in stream_resource_regular_dtor (rsrc=0xfd2348) at /home/cristian/php5/main/streams/streams.c:1381
#7  0x00000000007f7274 in list_entry_destructor (ptr=0xfd2348) at /home/cristian/php5/Zend/zend_list.c:184
#8  0x00000000007f418d in zend_hash_del_key_or_index (ht=0xddcc10, arKey=0x0, nKeyLength=0, h=2, flag=1)
    at /home/cristian/php5/Zend/zend_hash.c:497
#9  0x00000000007f6d41 in _zend_list_delete (id=2) at /home/cristian/php5/Zend/zend_list.c:58
#10 0x00000000007e144f in _zval_dtor_func (zvalue=0xff3800, __zend_filename=0xaf6d28 "/home/cristian/php5/Zend/zend_variables.h",
    __zend_lineno=35) at /home/cristian/php5/Zend/zend_variables.c:60
#11 0x00000000007cf326 in _zval_dtor (zvalue=0xff3800, __zend_filename=0xaf6cf8 "/home/cristian/php5/Zend/zend_constants.c",
    __zend_lineno=33) at /home/cristian/php5/Zend/zend_variables.h:35
#12 0x00000000007cf2e3 in free_zend_constant (c=0xff3800) at /home/cristian/php5/Zend/zend_constants.c:33
#13 0x00000000007f46a2 in zend_hash_apply_deleter (ht=0xddec80, p=0xff37a0) at /home/cristian/php5/Zend/zend_hash.c:611
#14 0x00000000007f4cf7 in zend_hash_reverse_apply (ht=0xddec80, apply_func=0x7cf3e1 <clean_non_persistent_constant>)
    at /home/cristian/php5/Zend/zend_hash.c:760
#15 0x00000000007cf893 in clean_non_persistent_constants () at /home/cristian/php5/Zend/zend_constants.c:170
#16 0x00000000007d1196 in shutdown_executor () at /home/cristian/php5/Zend/zend_execute_API.c:314
#17 0x00000000007e333c in zend_deactivate () at /home/cristian/php5/Zend/zend.c:899
#18 0x0000000000765b55 in php_request_shutdown (dummy=0x0) at /home/cristian/php5/main/main.c:1522
#19 0x0000000000883ebc in main (argc=2, argv=0x7fffffffdef8) at /home/cristian/php5/sapi/cli/php_cli.c:1307
 [2008-12-21 00:15 UTC] lbarnaud@php.net
Reproducible as long the stream resource is held by a constant:

<?php
define(FD, fopen('/dev/null','rw'));
stream_filter_append(FD, "any_user_filter");
?>

At engine shutdown the resource is not closed until volatile constants are destroyed, which happens after objects storage are freed.
 [2008-12-21 01:09 UTC] crrodriguez at opensuse dot org
Another reason to disable user defined resource constants...

Index: Zend/zend_builtin_functions.c
===================================================================
RCS file: /repository/ZendEngine2/zend_builtin_functions.c,v
retrieving revision 1.277.2.12.2.25.2.37
diff -u -p -r1.277.2.12.2.25.2.37 zend_builtin_functions.c
--- Zend/zend_builtin_functions.c       9 Dec 2008 19:17:11 -0000       1.277.2.12.2.25.2.37
+++ Zend/zend_builtin_functions.c       21 Dec 2008 01:09:21 -0000
@@ -616,7 +616,6 @@ repeat:
                case IS_DOUBLE:
                case IS_STRING:
                case IS_BOOL:
-               case IS_RESOURCE:
                case IS_NULL:
                        break;
                case IS_OBJECT:
 [2008-12-21 13:34 UTC] johannes@php.net
disabling userspace constants won't help, we'd also have to remove internal ones, but removing STD* would be stupid. 
 [2014-04-03 12:13 UTC] mike@php.net
-Status: Verified +Status: Closed -Assigned To: +Assigned To: mike
 [2014-04-03 12:13 UTC] mike@php.net
Thank you for your bug report. This issue has already been fixed
in the latest released version of PHP, which you can download at 
http://www.php.net/downloads.php


 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Thu Jul 17 00:01:31 2025 UTC